CISA KEV Adds Four Actively Exploited CVEs: Adobe Commerce, Windows, and N-able N-central — Detection and Remediation Guide

On September 8, 2026, CISA added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on confirmed evidence of active exploitation in the wild. This is not a theoretical risk assessment — these bugs are being used by threat actors right now against production environments:

• CVE-2026-75650 — Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine (server-side template injection)
• CVE-2026-81963 — Microsoft Windows Link Following vulnerability (symlink/junction-based privilege escalation)
• CVE-2026-85880 — Microsoft Windows Heap-Based Buffer Overflow
• CVE-2026-86218 — N-able N-central Static Code Injection

The combination here is significant for defenders. Two of the four — Adobe Commerce/Magento and N-able N-central — sit at exactly the trust boundaries attackers prize most: internet-facing e-commerce platforms and the remote monitoring and management (RMM) tooling that MSPs use to administer hundreds of downstream client networks. A template injection on your storefront and a code injection on your RMM are both direct paths to enterprise-wide compromise. Under Binding Operational Directive (BOD) 26-04, Federal Civilian Executive Branch agencies are required to remediate KEV entries on a defined timeline — but if history is any guide, the same actors hitting federal networks are hitting yours.

Technical Analysis

CVE-2026-75650 — Adobe Commerce / Magento Server-Side Template Injection

This is an improper neutralization of special elements in a template engine — in plain terms, a server-side template injection (SSTI). Template engines (Magento relies on its own templating layer over PHP) interpret user-controlled expressions. When attacker-supplied input reaches the template engine without proper sanitization, the injected expressions are evaluated server-side, which typically escalates to arbitrary PHP code execution under the web server account.

From a defender's perspective, the exploitation chain looks like this: attacker submits crafted input through a reachable storefront or admin surface → the payload is rendered by the template engine → arbitrary commands execute in the context of the web server process (php-fpm, httpd, or nginx workers) → webshell or reverse shell deployment → persistence and lateral movement. Because Adobe Commerce and Magento storefronts are internet-facing by design, exposure is near-total for unpatched instances. Check the Adobe security bulletin (APSB series at helpx.adobe.com/security) for the exact affected version ranges and the fixed release applicable to your deployment — both Adobe Commerce (cloud and on-prem) and Magento Open Source are in scope.

CVE-2026-81963 — Microsoft Windows Link Following (Privilege Escalation)

Link-following vulnerabilities in Windows are a well-worn but reliable local privilege escalation primitive. The pattern: a privileged Windows component or service performs a file operation (create, write, delete, move) at an attacker-influenceable path. By pre-placing a symbolic link, NTFS junction, or hardlink at that path, a low-privileged attacker redirects the privileged operation to an arbitrary target — overwriting a protected DLL, planting a file in a privileged directory, or deleting a critical system file to force a reload-and-load condition. The end result is code execution as SYSTEM.

Observable artifacts include mklink, mklink /j, mklink /h, or equivalent API-based link creation (tools like CreateSymbolicLink, or public tooling such as CreateSymlink.exe/FolderOrFileDeleteToSystem style PoC binaries) executed from non-administrative contexts, often immediately followed by a privileged service writing to an unexpected path. This class of bug is almost always chained: it follows initial access (phishing, another CVE) and precedes defense evasion and persistence.

CVE-2026-85880 — Microsoft Windows Heap-Based Buffer Overflow

Heap-based buffer overflows in Windows components are memory-corruption bugs where attacker-controlled data overwrites adjacent heap structures, corrupting function pointers or object metadata to hijack execution flow. Depending on the affected component and attack vector, these can yield remote code execution or local privilege escalation. Exploitation of heap corruption frequently leaves forensic fingerprints even when it fails: application crash artifacts, Windows Error Reporting (WER) entries, and WerFault.exe executions against the target process. Failed exploitation attempts are a detection opportunity — adversaries often need multiple attempts to stabilize a heap-spray or grooming-based exploit. Track the Microsoft Security Response Center (MSRC) advisory for CVE-2026-85880 to confirm the affected component, attack vector, and whether the September 2026 cumulative update remediates it for your OS builds.

CVE-2026-86218 — N-able N-central Static Code Injection

This is the one that should keep MSPs and their clients up at night. N-able N-central is an RMM platform — by design, it holds privileged, script-capable access to every managed endpoint in an MSP's portfolio. A static code injection vulnerability in the N-central server means an attacker can inject code that executes in the platform's context, and from there push arbitrary scripts, installers, or persistence mechanisms to every managed device downstream. This is the supply-chain multiplier effect: one compromised N-central instance equals compromise of every client network it manages.

RMM abuse is a documented, heavily used technique (MITRE ATT&CK T1219 — Command and Scripting Interpreter via remote access software), and RMM platforms themselves have been high-value targets in past campaigns. Hunt for the N-central server process spawning unexpected child processes (cmd.exe, powershell.exe, wscript.exe, script interpreters), unexpected file drops in N-central installation and data directories, and outbound connections from the N-central host to infrastructure that is not N-able's. Apply the vendor's hotfix per the N-able security advisory immediately, and treat any delay as an incident window.

Exploitation Status

All four CVEs are listed in the CISA KEV Catalog, which means CISA has confirmed active exploitation — this is not PoC-only or theoretical. Federal agencies are bound by BOD 26-04 remediation timelines; private-sector organizations should treat the KEV due date as their own ceiling, not a target.

Detection & Response

The detections below target the post-exploitation behaviors common to these four CVEs: web server process spawning shells (Magento SSTI), link-creation abuse (CVE-2026-81963), exploitation crash artifacts (CVE-2026-85880), and RMM server child-process abuse (CVE-2026-86218). Tune to your baseline before production deployment.

---
title: Web Server Process Spawning Shell or Script Interpreter
tid: 3f8a1c92-7b4d-4e21-9a53-2c6d8f1b9e04
status: experimental
description: Detects web server or PHP-FPM worker processes spawning command shells or script interpreters, consistent with post-exploitation activity following server-side template injection against Adobe Commerce/Magento (CVE-2026-75650).
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/09/09
tags:
  - attack.execution
  - attack.t1059
  - attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/php-fpm'
      - '/httpd'
      - '/nginx'
      - '/apache2'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/curl'
      - '/wget'
      - '/python'
      - '/python3'
      - '/perl'
      - '/base64'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate Magento cron jobs and maintenance scripts invoking shells
  - Deployment pipelines executing commands under the web user
level: high
---
title: Web Server Process Spawning Shell or Script Interpreter (Windows IIS)
tid: 6b2e4d18-9c3a-4f57-b812-5e7a2d4c8f16
status: experimental
description: Detects IIS worker processes spawning command shells or scripting engines, consistent with web-facing code injection post-exploitation behavior.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/09/09
tags:
  - attack.execution
  - attack.t1059.003
  - attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\php-cgi.exe'
      - '\php.exe'
      - '\httpd.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Web applications legitimately invoking system commands (rare; investigate)
level: high
---
title: Symbolic Link or Junction Creation by Non-Standard Process
tid: 9d4c7a25-1e8b-4d63-a794-8f2b6c3e5d91
status: experimental
description: Detects creation of NTFS symbolic links, junctions, or hardlinks via mklink, a common primitive in Windows link-following privilege escalation exploits such as CVE-2026-81963.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/09/09
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: process_creation
  product: windows
detection:
  selection_cmd:
    CommandLine|contains:
      - 'mklink /j'
      - 'mklink /h'
      - 'mklink /d'
      - 'mklink '
  filter_legit:
    Image|endswith:
      - '\msiexec.exe'
  condition: selection_cmd and not filter_legit
falsepositives:
  - Developer workflows and software packaging creating junctions
  - OneDrive and backup software link operations
level: medium

// Hunt: Post-exploitation behaviors across the four KEV CVEs
// 1) N-central or web server processes spawning shells/scripting engines (CVE-2026-86218, CVE-2026-75650)
// 2) mklink-based link creation (CVE-2026-81963)
// 3) WerFault crash artifacts indicating failed heap-overflow exploitation (CVE-2026-85880)
let suspiciousChildren = dynamic(["cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","rundll32.exe","certutil.exe","bitsadmin.exe","mshta.exe"]);
let rmmAndWebParents = dynamic(["w3wp.exe","php-cgi.exe","php.exe","httpd.exe","NcAgentUi.exe","PME.Agent.exe","N-central.exe","java.exe","tomcat9.exe"]);
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| extend ParentName = tostring(split(InitiatingProcessFileName, "")[0])
| where (InitiatingProcessFileName in~ (rmmAndWebParents) and FileName in~ (suspiciousChildren))
    or (ProcessCommandLine has_any ("mklink /j", "mklink /h", "mklink /d"))
    or (FileName =~ "WerFault.exe" and InitiatingProcessFileName !in~ ("svchost.exe","explorer.exe"))
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256, ReportId
| order by TimeGenerated desc

-- Hunt: Suspicious child processes of web servers / RMM agents and recent symlink creation
-- Targets post-exploitation for CVE-2026-75650, CVE-2026-86218, and CVE-2026-81963
LET suspicious_children = '(?i)(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|certutil|bitsadmin|sh|bash|curl|wget)'
LET suspicious_parents = '(?i)(w3wp|php|httpd|nginx|apache|tomcat|ncentral|ncagent|java)'

SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime,
       get_process_name(pid=Ppid) AS ParentName
FROM pslist()
WHERE CommandLine =~ suspicious_children
   OR Name =~ suspicious_parents
   OR CommandLine =~ '(?i)mklink\s+/(j|h|d)'
ORDER BY CreateTime DESC

# CVE-2026-81963 / CVE-2026-85880 — Windows patch verification and hunting aid
# Run elevated on Windows hosts. Verifies September 2026 (or later) cumulative update presence
# and flags suspicious link-creation and crash artifacts from the last 14 days.

$os = Get-CimInstance Win32_OperatingSystem
Write-Host "[*] Host: $env:COMPUTERNAME | OS Build: $($os.BuildNumber).$((Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').UBR)"

# 1. Confirm recent cumulative updates are installed
Write-Host "`n[*] Installed hotfixes (last 90 days):"
Get-HotFix | Where-Object { $_.InstalledOn -gt (Get-Date).AddDays(-90) } |
    Sort-Object InstalledOn -Descending |
    Format-Table HotFixID, Description, InstalledOn -AutoSize
Write-Host "[!] VERIFY: the September 2026 (or later) cumulative update remediating CVE-2026-81963 and CVE-2026-85880 must appear above. If absent, patch immediately per MSRC guidance."

# 2. Hunt for mklink usage in process creation events (requires command-line auditing / Sysmon)
Write-Host "`n[*] Searching for mklink / junction creation (last 14 days):"
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=(Get-Date).AddDays(-14)} -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'mklink' } |
    Select-Object TimeCreated, Message -First 25

# 3. Hunt for WerFault crash artifacts (possible failed heap-overflow exploitation, CVE-2026-85880)
Write-Host "`n[*] Recent Windows Error Reporting crash artifacts:"
Get-ChildItem "$env:ProgramData\Microsoft\Windows\WER\ReportArchive","$env:ProgramData\Microsoft\Windows\WER\ReportQueue" -Recurse -ErrorAction SilentlyContinue |
    Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-14) } |
    Sort-Object LastWriteTime -Descending |
    Select-Object FullName, LastWriteTime -First 25

# 4. Flag writable symlink-relevant behavior: check for unexpected junctions in temp/profile dirs
Write-Host "`n[*] Junctions/reparse points in user-writable locations:"
Get-ChildItem "$env:TEMP", "$env:PUBLIC", "C:\Users" -Recurse -Force -ErrorAction SilentlyContinue |
    Where-Object { $_.Attributes -match 'ReparsePoint' } |
    Select-Object FullName, LinkType, Target -First 25

Remediation

1. Patch to vendor-fixed releases immediately. CISA KEV listing means active exploitation — the BOD 26-04 remediation deadline for federal agencies applies, and private organizations should hold themselves to the same clock. Specifically:
   • Adobe Commerce / Magento (CVE-2026-75650): Apply the hotfix or upgrade to the fixed version listed in Adobe's security bulletin at https://helpx.adobe.com/security/security-bulletin.html. Both Adobe Commerce and Magento Open Source deployments are in scope. If you cannot patch within 24 hours, restrict admin panel access by IP allowlist and place the storefront behind a WAF with virtual patching rules blocking template-expression payloads in request parameters.
   • Microsoft Windows (CVE-2026-81963, CVE-2026-85880): Deploy the September 2026 (or later) cumulative update addressing both CVEs per the MSRC advisories at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81963 and https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85880. Prioritize systems where unprivileged users have local access (VDI, jump boxes, shared workstations) for the link-following bug, and any host running the affected component for the heap overflow. Verify installation with the script above — do not assume WSUS/Intune compliance reporting is accurate during an active exploitation window.
   • N-able N-central (CVE-2026-86218): Apply the vendor hotfix per N-able's security advisory at https://www.n-able.com/security-and-trust/security-advisories without delay. If patching must be scheduled, restrict network access to the N-central management interface to known administrator IPs only, and audit all recent scripts, scheduled tasks, and software deployments pushed through the platform for anything you did not authorize.
2. Assume the window between exploitation start and patch was hostile. For internet-facing Magento instances and N-central servers, run the hunt queries above across at least the last 30 days of telemetry. Look for webshells (unexpected files in Magento pub/, var/, and media directories), unauthorized admin accounts, and unexpected outbound connections from the server.
3. Audit RMM blast radius. For N-central specifically: review all automation policies, script repositories, and API keys. Rotate credentials for service accounts used by the platform. Confirm firmware/agent versions on probes match what you deployed.
4. Operationalize the KEV as your patch SLA. If your vulnerability management program does not already auto-escalate CISA KEV entries to an emergency change track with a fixed SLA (7-14 days maximum, 24-72 hours for internet-facing), this week is the reason to fix that. KEV-listed CVEs are the single highest-fidelity prioritization signal available.
5. Validate compensating controls. Confirm EDR coverage on web servers and the N-central host, command-line process auditing is enabled, and egress filtering would alert on a compromised storefront or RMM server beaconing out.

Category

vulnerability-management

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub